Privacy Policy

v19 Corporation (the "Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Kanri (the "Service"). This Privacy Policy provides notice of our practices; it does not replace any consent or other legal authority required for a particular collection, use, or disclosure of personal information.

1. Information We Collect

1.1 Personal Information:

We collect personal information that you provide to us, including but not limited to:

• Name
• Email address
• Phone number
• Physical address
• Billing information
• Organization or business name (if applicable)
• Any other information you choose to provide when creating or managing your account

1.2 Usage Data:

We automatically collect certain information about your use of the Service, including but not limited to:

• IP address
• Browser type and version
• Operating system
• Pages visited and time spent on them
• Device information (e.g., device type, screen resolution, unique device identifiers)
• Referring and exit pages
• Clickstream data

1.3 Payment Information:

Payments processed through the Service are handled by Stripe, our third-party payment processor. We do not store your full payment card details. Stripe and its applicable affiliates process payment information under their applicable agreements and Privacy Policy. Stripe may also process information for its own legal, fraud prevention, and other purposes described in that policy.

1.4 Cookies and Tracking Technologies:

We use cookies and local storage to operate the Service and remember your preferences. You may configure your browser to refuse cookies, but some features of the Service may not function properly as a result. We use Cloudflare Web Analytics for website traffic and performance measurement. This is separate from school audit logs. We do not use advertising pixels or personal information for cross-context behavioral or targeted advertising.

1.5 AI Interactions and Feedback:

AI-powered features, including the Kai assistant and external assistant connections, are optional. School records are not submitted for AI processing through these features unless the applicable feature is enabled and used by an authorized user. When you use Kai, we process and store your prompts, responses, conversation history, and records retrieved within your permissions to answer your requests and maintain conversation context. Depending on the request and your permissions, this information may include member, attendance, billing, and children's information, health or other sensitive notes, and family communications.

Kanri does not use your AI prompts, responses, retrieved records, or feedback to train or fine-tune AI or machine learning models. If you voluntarily submit a rating, such as a thumbs-up or thumbs-down, or other feedback about Kai, authorized Kanri personnel may review the entire associated conversation, including prompts, responses, and any school records included in that conversation. We use this review to assess response quality and improve system instructions, available tools, and feature behavior, not to train model parameters. Submitting feedback does not authorize unrelated uses of personal information or replace any required authority to disclose it. We do not submit these conversations to provider feedback or model-training programs.

Kai uses Cloudflare services and may use Anthropic's commercial API, as described in Section 7. Model inference (generating a response) is separate from storage of conversation history, feedback, logs, and cached content. Neither our no-training commitment nor a provider's no-training policy means that interactions are not stored or reviewed. We do not represent that all AI processing has zero retention or occurs within Canada.

Kai and external assistant connections are separate features. Connecting an external assistant does not itself initiate a Kai conversation. Documentation search uses Cloudflare AI Search to search public Kanri help pages. Although that search index contains public documentation rather than school records, the submitted search question is sent to Cloudflare for processing, including model-based retrieval and, where configured, query rewriting or ranking. Information included in the question is therefore also submitted. Do not include member details, private notes, or other confidential information in documentation-search questions.

1.6 Information Provided by Schools:

Schools and organizations that use the Service may provide us with information about their members, including names, contact details, membership status, attendance records, and billing information. This information is uploaded by the school and processed by Kanri on the school's behalf. If your school provided your information to us, the school is responsible for establishing and maintaining lawful authority for its collection and for the processing it instructs Kanri and our service providers to perform, including providing required notices and obtaining any required consent from you or your authorized parent or guardian. Our Service Agreement requires the school to represent and warrant that it has that authority and any required consent. This allocation does not remove Kanri's own obligations under applicable law or authorize unrelated uses of your information. For processing that Kanri determines for its own account administration, billing, legal obligations, or the separately described voluntary feedback review, Kanri remains responsible for its own compliance.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and maintain the Service
• To process payments and manage billing
• To communicate with you about updates, support, and promotions
• To monitor and analyze usage to improve the Service
• To provide optional AI features and conversation history, and to review voluntarily submitted AI feedback as described in Section 1.5
• To maintain school audit logs on the school's behalf solely for accountability and transparency, as described in Section 6
• To comply with legal obligations

3. How We Share Your Information

3.1 With Your School or Organization:

If you are a member, student, parent, or staff member of a school or organization that uses the Service, we share your information (including name, contact details, payment status, attendance, and progress data) with that school or organization. The school controls how your information is used within its operations on the platform.

3.2 With Service Providers:

We share your information with third-party service providers who help us operate the Service, such as hosting providers, analytics services, payment processors (e.g., Stripe), and the AI service providers described in Section 7. Our use of service providers does not relieve us of our obligations under applicable privacy law.

3.3 For Legal Reasons:

We may disclose your information when required to do so by law or in response to valid legal requests, such as subpoenas or court orders.

3.4 Business Transfers:

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity.

3.5 External AI Assistants:

Where enabled, an authorized staff member can connect an external assistant through the Model Context Protocol (MCP). Kanri requires school enablement and the staff member's separate authorization. The connection can cover selected schools or all current and future eligible schools. It remains limited by the staff member's current permissions in each school. It can disclose permitted records, including member, attendance, and billing information, as well as record-field descriptions, reports, key performance indicators (KPIs), and workflow definitions. Records may include the sensitive information described in Section 1.5. Read-only access still transfers information outside Kanri.

The school is responsible for deciding whether this disclosure is lawful and appropriate, providing required notices, and obtaining any required authority and consent. An administrator enabling the feature or a staff member authorizing a connection is not automatically consent from members or guardians, or authority to combine independently controlled schools' data. External assistants are selected by the school or staff member, rather than engaged by Kanri to provide Kai. Their providers may process, retain, transfer, review, or use exported content, including for model training, depending on the product, account settings, and applicable agreements. Kanri's no-training commitment and the provider summaries for Kai in Section 7 do not extend to independently selected assistants. Review the selected provider's terms and settings before connecting.

4. Your Choices

4.1 Access and Correction:

You may access and update your account information through the Service's account settings.

4.2 Opt-Out:

You may opt out of receiving promotional emails by following the unsubscribe link in our communications. Note that you may still receive important administrative or transactional emails. Canadian users have the right to withdraw consent to commercial electronic messages at any time in accordance with Canada's Anti-Spam Legislation (CASL).

4.3 Data Deletion:

You may request the deletion of your account and associated data by contacting us at legal@v19.io.

4.4 External Assistant Access:

Staff can revoke a connection in their personal settings. School managers can disable their school's external assistant access or revoke an individual connection's access to that school. These controls prevent new requests from accessing the affected school records; a request authorized before revocation takes effect may complete. Revocation does not recall information already exported or delete the assistant provider's copies. Address those copies through that provider's controls and privacy-request process, or contact the school that authorized the disclosure. You may also contact us to exercise rights relating to information under our control.

5. Data Security

We employ a range of technical and organizational measures to safeguard your personal information, including encryption, firewalls, and access controls. Data is stored on secure servers, and access is limited to authorized personnel who are required to maintain confidentiality. While we strive to protect your data, no method of transmission over the internet or electronic storage is entirely secure. In the event of a data breach, we will take appropriate steps to mitigate the impact and notify affected users as required by applicable law.

6. Data Retention

Subject to the separate MCP request-audit and provider-retention provisions below, we retain your account information and school records, including school audit logs, stored Kai conversations, and associated feedback, for as long as your account is active and for a period of 90 days following account closure or a verified deletion request, after which it is permanently deleted from our systems. We will act sooner where required by applicable law. School records may be retained beyond the applicable period where required by law, including a legally binding preservation requirement. Separate records needed for Kanri's own billing, legal compliance, fraud prevention, or legal claims may be retained as necessary and permitted by law; this is not an exception allowing unrelated reuse of school records or audit logs. Schools' member data stored on the platform is subject to the same 90-day post-termination retention period. If an authorized school export is requested before deletion, we will complete that request before deleting the requested data, unless earlier deletion is required by law, as described in the Service Agreement.

Separately, MCP request-audit records are retained for 90 days from the request, subject to legally required retention. They contain account, client, connection, and authorized-school references, the operation, metadata describing the structure of request arguments, timing, size, and outcome, not raw questions, credentials, or returned member records. This limited-content description applies to MCP request-audit records, not to Kai conversation history or AI Gateway logs.

School audit logs are records maintained on the school's behalf solely for accountability and transparency. They allow authorized school users to review past conversations, actions taken through the Service, and the requests or events that prompted those actions, including feature enablement, connection authorization, and revocation. We do not maintain these records as Kanri telemetry or use them for our own analytics, advertising, or model training. Review of conversations voluntarily submitted as feedback is a separate activity described in Section 1.5; retention in a school audit log alone does not authorize that review.

School audit logs do not currently have a fixed age-based automatic deletion schedule while the school's account is active. They remain subject to the school-data deletion period above, the school's lawful instructions, and applicable retention and deletion requirements. The school is responsible for determining how long its audit history is needed for accountability and transparency and communicating any earlier deletion requirements to Kanri. This does not permit indefinite retention after that purpose has ended, except where retention is required by law. Contact us at legal@v19.io about access to or deletion of information in these logs.

Our AI service providers may also retain request and response content, operational metadata, and, where applicable, cached content or backups under the service-specific terms and settings described in Section 7. We remain responsible for applicable deletion obligations for information processed on our behalf. Disabling an AI feature or revoking a connection does not itself delete stored conversations, logs, or provider-held copies. Copies exported to independently selected assistants are subject to those providers' retention arrangements and applicable law, rather than Kanri's 90-day schedule.

7. Third-Party Services

7.1 Providers Used for Kanri AI Features:

We use Cloudflare, Inc. for Workers AI model inference, AI Gateway request routing and observability, and AI Search documentation retrieval. Cloudflare's Developer Platform Service-Specific Terms address Workers AI and AI Gateway, including Cloudflare's commitment not to use customer content to train generative AI tools unless otherwise agreed. Its Workers AI data-usage documentation distinguishes standard inference from storage required by stateful features and from operational metadata and legal or security exceptions.

Cloudflare AI Gateway can retain prompts and responses in logs; logging is enabled by default. Retention depends on the applicable logging service, account configuration, and any exported copies. Caching is separate and can retain responses when enabled. See Cloudflare's AI Gateway logging documentation, caching documentation, and Data Processing Addendum. Routing through AI Gateway does not mean that only Cloudflare receives the content. Cloudflare's Data Processing Addendum does not cover third-party products accessed through AI Gateway; the relevant provider's applicable terms govern that processing.

Kai may also send prompts, conversation context, and retrieved records to Anthropic, PBC through its commercial API, including requests routed through Cloudflare AI Gateway. Anthropic's Commercial Terms and Data Processing Addendum govern that service. Under its published commercial-product training policy, Anthropic does not use commercial API inputs or outputs for model training by default; voluntarily submitted provider feedback and express training opt-ins are treated differently.

Anthropic's commercial-data retention policy generally provides for deletion of API inputs and outputs within 30 days, with exceptions for agreed arrangements, features that store content, model-specific safety requirements, policy enforcement, and legal obligations. Its policy describes longer retention for flagged inputs and outputs (up to two years), safety classification scores (up to seven years), and feedback submitted to Anthropic (five years). These are provider-side practices, not a deletion schedule for conversations stored by Kanri. This summary concerns commercial API use, not a consumer Claude account connected independently through MCP.

These links explain provider practices and do not replace this Privacy Policy or reduce our obligations. The applicable service agreements, features, and settings determine provider processing. We will provide notice of material changes to our AI data practices in accordance with Section 11 and obtain consent where required before applying those changes.

7.2 Independently Selected Third-Party Services:

The Service may include links to third-party websites or services. Those parties' independent practices, including those of external assistants you connect through MCP, are governed by their own terms and privacy policies. This Privacy Policy continues to govern Kanri's handling of information, including our disclosure to an authorized integration.

8. International Users

Your information may be transferred to and processed in Canada, the United States, or other countries where our servers or service providers are located. External assistants may also process exported information in other countries under their own arrangements. These transfers remain subject to applicable legal requirements; enabling an integration does not waive those requirements. Information processed abroad may be accessible to courts, law enforcement, or other authorities under the laws of those jurisdictions. We remain responsible for the safeguards required by applicable law for information transferred to our service providers.

9. Children's Privacy

Accounts and direct use of the Service are intended for people aged 13 or older who meet any higher local minimum age. Minors must have the permission and parent or guardian agreement described in our Terms of Service. This contractual requirement does not replace any parental or other consent separately required by privacy law. If you believe a child is using an account contrary to these requirements or that their information has been collected unlawfully, contact us at legal@v19.io.

Because schools and organizations use the Service, information about children — such as names, attendance records, or other educational data — may be stored on the platform, including records about children too young to use accounts. Schools and parents or guardians may supply this information, and eligible teenage users may submit information through their permitted use of the Service. For records processed on a school's behalf, we act as its service provider or processor, as applicable. If we learn that we have collected personal information directly through an under-13 account contrary to applicable law, we will restrict the account and take the steps required by law to address that collection, including deletion where required. This is distinct from lawful school-managed membership records.

Before disclosing children's information, health details, sensitive notes, or family communications to an AI provider, schools must assess whether the disclosure is necessary and permitted, provide any required notices, and obtain any required consent, including parental or guardian consent where applicable. School or staff opt-in is not a substitute for those requirements. Do not submit information you lack authority to share.

10. Privacy Rights

10.1 Canadian Residents:

As a Canadian corporation, v19 Corporation complies with Canada's federal private sector privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial privacy laws such as Quebec's Act respecting the protection of personal information in the private sector (Law 25). You have the right to access your personal information held by us, request corrections, and withdraw consent for certain uses, subject to legal exceptions. To exercise these rights, contact us at legal@v19.io.

10.2 United States Residents:

Depending on your state of residence and the law applicable to the processing, you may have rights to confirm whether we process personal information, access or obtain a portable copy, correct inaccuracies, request deletion, limit certain uses of sensitive information, or opt out of specified processing, including profiling used for legally or similarly significant decisions. These rights are subject to applicable conditions and exceptions. Kanri does not sell personal information or share it for cross-context behavioral advertising, and does not use it for targeted advertising.

10.3 Requests and Appeals:

Send privacy requests to legal@v19.io. We may request information reasonably necessary to verify your identity or an authorized agent's authority, where permitted by law. If your request concerns records we process on a school's behalf, we will assist in directing it to the school and cooperate with the school as required, without limiting obligations that apply directly to Kanri. A parent or guardian may exercise a child's rights where authorized by law.

We will respond within the period required by applicable law and explain any permitted extension or denial. Where you have a right to appeal a denial, reply to our decision or email legal@v19.io identifying your request and the basis of your appeal. We will explain the outcome within the applicable period and provide information about contacting the relevant regulator where required. You may also complain to the appropriate privacy or consumer-protection authority. We will not unlawfully discriminate against you for exercising your privacy rights.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on our website, and the "Effective Date" will be updated accordingly. For information processed on a school's behalf, we will provide notice of material changes before they take effect to the school's registered owner or administrator contact by email, or through an in-Service notice directed to school owners or administrators. The school is responsible for communicating relevant changes to affected individuals. Except where applicable law requires otherwise, we are not required to separately contact each person whose information the school supplies. For material changes affecting information we process independently of a school, we will notify affected users by email or through the Service before those changes take effect. We remain responsible for any direct notice required of us by applicable law. Where applicable law requires consent to a new collection, use, or disclosure, we will obtain that consent before proceeding; continued use alone does not replace it.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at legal@v19.io.